Re: Re: ECCN and CCATS for PHP

On Fri, Nov 9, 2012 at 6:39 AM, Pierre Joye <pierre.php@gmail.com> wrote: > we should really add this info to the download page :) I agree to having information on the page, but I'm not entirely sure the TSU exception applies here. About three weeks ago, I was on the phone with reps from the State Department and BIS/DOC discussing PHP. They suggested the best option was to self-classify the ECCN (which, as a listing, would probably be closest to 5D992/5D991 or 5D002). If classifying as a 5D002, with the exclusion of E:1-listed countries (of which there are now only five: Cuba, Iran, North Korea, Sudan, and Syria), 740.13(e) does provide for exception under the TSU; however, beyond PHP itself, software built using the language doesn't necessarily fall into the same scope (or, so it seems is hinted by 734.4(b)(4)). If classifying as 5D992 or 5D991, there is no such exemption. However, because PHP doesn't meet the requirements or exclusions under any of the 5D listings in entirety, it is probably best classified as EAR99. A quick Google search this morning shows that ActiveState (who distribute modified versions of Perl, Python, Tcl, et cetera) self-classified their works as EAR99[1] as well, which helps to make a reasonable case for the same classification on our end. Other projects, such as Apache's Perl distribution, mod_perl, classify as 5D002[2], but they distribute OpenSSL as part of the pre-compiled binary package. OpenSSL, of course, would be 5D002, but because of the unrestricted, publicly-available source code, it gets TSU exemption. Thus, the project as a whole, to me, would be self-classified as an EAR99. So either way, whether calling it a 5D002 with TSU exception or an EAR99, exporting and re-exporting is allowed with the exception of the E:1 countries listed above. All of that (so long-windedly, my apologies) discussed, for the sake of a definitive statement on the website, was the 5D002+TSU listing determined by a legal professional, Johannes, or was it a self-classification? Because if it hasn't been so determined yet, we may want to officially self-classify or re-classify under EAR99. ^1: http://community.activestate.com/tags/export ^2: http://www.apache.org/licenses/exports/ OBLIGATORY STATEMENT DUE TO CONTEXT: The content of this message was neither written nor reviewed by a lawyer or other legal professional of any sort. These statements are my own based upon self-directed research and my personal interpretation of the laws of the United States of America at the time of this writing. They are not intended and thus should not be construed as any form of legal advice, guidance, direction, or precedent, nor any basis of fact for argument in favor of or against the nature of this subject or related matters. Instead, for actual advice, guidance, or direction, you should consult a legal professional authorized to practice law in your jurisdiction. -- </Daniel P. Brown> Network Infrastructure Manager http://www.php.net/